Skip to the main content
TraceErase

How it works

How TraceErase helps you protect your personal data

You use the security tools and the guided routes yourself. For organisations on the managed list, you can choose eligible requests, give permission, and TraceErase handles the next steps for the organisations it supports. A member of our team approves the exact wording first, and a limited number are sent each day, shared fairly between customers. You do the steps that need your own login, verification or confirmation.

Create your accountSearch the directory

Your journey, and who handles each step

You can stop after any step. Everything up to “keep the record” is available with an account; asking TraceErase to handle a request is an extra, with a plan, for the organisations it supports.

Your journey, and who handles each stepEach step names only the people and systems that act in it. The key shows who they are.
  • You
  • TraceErase software
  • TraceErase team
  • The organisation

  1. Step 1: Create your account

    • You

      You: Give a name, an email address and a password, then open the confirmation link.

    • TraceErase software

      TraceErase software: Sends the confirmation email. Creating an account doesn’t buy or send anything.

  2. Step 2: Check and search

    • You

      You: Run the password check and search the directory for services you use. With the plan, and when the breach service is available, check which known breaches include your account email.

    • TraceErase software

      TraceErase software: Checks a password without receiving it, and shows what the directory holds, with dates. If the breach service is unavailable it says so, and never shows an all-clear.

  3. Step 3: Take action on your own

    • You

      You: Follow the organisation’s own official steps on its site, or prepare a request from a draft, review it and send it yourself.

    • The organisation

      The organisation: Handles what you send it, and replies in its own time.

    Many official opt-outs are free to do yourself.

  4. Step 4: Keep the record

    • You

      You: Record what you sent and any reply you get.

    • TraceErase software

      TraceErase software: Keeps the case, and works out a response date from the dates you record. It is a guide, marked “needs confirming” when uncertain.

  5. Step 5: Or choose eligible requests for TraceErase to handle

    Right now: Checking whether this is available…

    • You

      You: Choose the organisation and action, and give written permission that you can withdraw. Do any step only you can do, such as signing in: it shows as “You complete this step”.

    • TraceErase software

      TraceErase software: Prepares the request and, for an email route TraceErase has checked, sends it once our team has approved the exact wording.

    • TraceErase team

      TraceErase team: Approves the exact wording first, and submits through the organisation’s approved route where software can’t.

    • The organisation

      The organisation: Decides its response.

  6. Step 6: Follow progress, responses and outcomes

    • You

      You: Report a response you received yourself.

    • TraceErase software

      TraceErase software: Shows the status and dates from what was actually recorded, and says who vouches for each outcome.

    • TraceErase team

      TraceErase team: Records a response on a managed request, with its scope.

    • The organisation

      The organisation: Responds, or doesn’t.

    A send, a reply or a date passing is never shown as proof that data has gone.

If an organisation needs something only you can do, such as signing in or confirming your identity, the request waits for you and we say exactly what is needed. If we can’t tell whether a send went through, a member of the team checks, and nothing is sent again blindly.

Who handles what

Some things you do with the tools, some TraceErase handles on its managed list, and some need you. We say plainly which is which.

You can do yourself

  • Check a password against known breaches.
  • Search the directory and follow the official steps TraceErase has checked and dated.
  • Prepare, send and track your own requests and complaints.
  • Record the replies you get.

TraceErase handles

  • Supported requests for organisations on the managed list: you choose and give permission, and TraceErase handles the next steps.
  • Software prepares each request and a member of our team approves its exact wording.
  • TraceErase sends or submits it. A limited number are sent each day, shared fairly between customers, so no time is promised.
  • Progress for each request: its status and any response, in one place.

Your participation is needed

  • Logging in on an organisation’s own site.
  • Identity checks and confirmations an organisation asks for. These show as “You complete this step”.
  • Giving, and if you wish revoking, written permission for managed requests.
  • Telling us when an organisation replies to you directly.

An example with sample data, so you can see the tools before you sign up.

Example viewSample data. Not a real account.

Password check

Sample password: a made-up exampleAppears in known breaches: example

Sample result. The check is done in your browser. The complete password is never sent to TraceErase or to Have I Been Pwned. Only the first five characters of a one-way hash of it are sent to a Have I Been Pwned service. If a password appears in a list, choose a different one.

Breach information for your account email

user@example.invalidUnavailable

Sample state. When the breach service can’t be reached the page says so. That isn’t an all-clear.

Checks run when you ask, or on a schedule if you turn that on. They don’t prevent breaches and aren’t antivirus.

Different actions do different things

People often use “delete” to mean several things. They are separate actions with separate results, so TraceErase keeps them apart. TraceErase can send the first three for organisations on its managed list; the other two stay with you.

  • Object to marketing

    TraceErase can send this for organisations on the managed list

    What it does. Asks the organisation to stop using your details to send you direct marketing.

    What it doesn’t do. Doesn’t erase your data or close an account. The organisation may keep a minimal record so your opt-out is honoured, and it may keep sending messages it is legally or contractually required to send.

  • Withdraw consent

    Managed list: sent with the marketing objection

    What it does. Withdraws any consent you gave the organisation to use your details for marketing.

    What it doesn’t do. Doesn’t delete the data it holds. Withdrawing consent and asking for erasure are separate requests with separate answers.

  • Ask for erasure

    Managed list: a separate request in the same email

    What it does. Asks the organisation to erase personal data it no longer needs.

    What it doesn’t do. Isn’t a promise of deletion. The organisation may have lawful reasons to keep some records, such as a loan agreement, and it decides and replies. We show what it told us.

  • Close an account

    You do it on the organisation’s own site

    What it does. Stops you using a service. The directory shows the organisation’s own steps, checked by TraceErase and dated.

    What it doesn’t do. Doesn’t necessarily erase your data. Closing a credit account or cancelling a loan is outside TraceErase.

  • Request a copy of your data

    You prepare it and send it yourself

    What it does. A subject access request (SAR) asks what personal data an organisation holds about you, why, and who it shares it with.

    What it doesn’t do. Doesn’t delete or change anything. It gives you information you can use for your next step.

Managed assistance

How eligible requests are handled for you

Broker cleanup is the first managed feature. The same steps apply to any organisation on the managed list. About Loan Broker Cleanup.

Checking whether broker cleanup is open…

Choose, we handle it, you follow the progressThree stages for a request TraceErase handles, who acts in each, and where it waits. A branch shows the steps only you can do. This is the service as designed; the label shows whether it is open now.

Managed requests right now: Checking whether this is available…

  1. Stage 1

    Choose and give permission

    You choose the organisations and what to ask for, then read and confirm a written permission. It names each organisation and action, shows when it ends and can be withdrawn.

    • You

    Where it waits: Nothing happens until you confirm it.

  2. Stage 2

    TraceErase handles eligible requests

    TraceErase prepares each request from the route TraceErase has checked for that organisation, against its own pages. A member of our team approves the exact wording, then software sends it or the team submits it, depending on the organisation. Your permission and account are checked again before anything goes.

    • TraceErase software
    • TraceErase team

    Where it waits: A request waits for our team to pick it up, so no time is promised. If we can’t tell whether a send went through, we check. It isn’t sent again blindly.

  3. Stage 3

    Follow progress and respond only when needed

    Follow each request in your account: its status, dates and any response, with who vouches for it. You step in only where an organisation needs something from you.

    • You
    • The organisation
    • TraceErase team

    Where it waits: Request sent isn’t delivered, and neither is removed. The organisation decides what it does and may keep data it is entitled to keep.

Branch: You complete this step

Some organisations need something only you can do, such as signing in, confirming your identity, following a confirmation link or using their own form. The request pauses and we say what is needed, why, where to go and any date we can support. It shows as “Action needed from you”. Nothing is sent while a step is open, and when you have done it the request carries on.

  • You
  • The organisation

You can stop at any point. Withdraw your permission or cancel a request that hasn’t been sent. A request already sent can’t be called back automatically.

Requests are sent a few at a time. A limited number are sent each day, shared fairly between customers, so we promise no time and nothing is sent in a rush.

Not every request ends in removal. The organisation may decline, keep some data or not reply, and we show what it said. Not every organisation is covered: the list is read live.

Who does what depends on the organisation

Every organisation we cover is in one of three groups, and the coverage page shows which. A single request can mix them: we send what we can, and tell you plainly what is left for you.

  • Handled by TraceErase

    You give permission. Software prepares the request, a member of our team approves the exact wording, and then TraceErase handles the sending: software or our team, depending on the organisation. You do nothing further unless the organisation asks for something.

    The route is an email address that TraceErase checked on the organisation’s own privacy notice, with the date shown on the coverage page. We don’t claim a technical integration with any organisation.

  • You complete this step

    The organisation needs your own login, an identity check, a CAPTCHA or a final confirmation, or takes requests only through its own form or the post. You do that step.

    We don’t log in for you, hold your passwords or get around identity checks. We tell you what is needed, show you what to send and keep track. TraceErase hasn’t sent it.

  • Route being checked

    We have no reliable route for this organisation yet, or the route needs more review. Nothing is sent to it.

    You can still use the account tools to write to it yourself.

Nothing is shown as done by software when a person has done it, and no progress is shown while nobody is doing the work.

Some organisations require you to verify your identity or complete a step directly. If that happens, we’ll explain exactly what you need to do.

A reply isn’t always confirmation that everything was removed: an organisation may keep some information, and we show you what it said and how far it reaches. Many official opt-outs are free to do yourself. TraceErase charges for its actual service and tools, not for your statutory rights.

For managed requests, your permission is written, specific and revocable

What you agree to

  • The wording is written and versioned, so we can show exactly what you agreed to.
  • It names the organisations and actions, and lists which details we send, such as your name and email address.
  • It ends on a date you can see before you agree, and you can revoke it at any time in your account.
  • Agreeing to this is separate from any consent to receive marketing from TraceErase, which isn’t assumed.

What revoking does

  • It stops future sends under that permission and cancels requests not yet sent.
  • It can’t recall a request that has already been sent. The page says so.
  • The recipient always comes from our list of checked routes, never from what is typed into a form.
  • Before each send we check again that your permission is still valid and your account is active.

Before anything is sent you read and approve the exact wording, and a member of staff approves the same wording and recipient. Each approval is tied to that exact content. If anyone edits it, both approvals are cleared and you are asked to approve the changed wording again.

What each status means: sending, responding and removal are different things

A send, a response or a date passing is never proof that data has been removed. TraceErase shows what has actually happened, and says who vouches for each outcome.

  1. Ready for you to confirm

    Your permission is given. Nothing is queued and nothing is sent until you confirm your plan and release the request.

  2. Received: our team will prepare your request

    Your request is waiting for our team to pick it up. We don’t call this “processing”, because nobody is working on it yet, and we promise no time.

  3. Preparing your request

    A member of our team has taken it and is checking the exact wording and recipient. Nothing is sent until it is approved.

  4. Ready to send

    Our team approved the exact wording and it is waiting to be sent. Any edit after approval needs approving again.

  5. Queued

    Approved and waiting its turn. A limited number of requests are sent each day, shared fairly between customers, so a request can wait, and we promise no time.

  6. Request sent

    The mail service accepted the email (or our team submitted it and recorded a receipt). We then wait for a response. That isn’t delivery confirmation, and it isn’t the organisation having done anything.

  7. Delivery confirmed

    Shown only when the mail service confirms delivery. Even then, delivered isn’t removed.

  8. Response received

    A response arrived. It doesn’t yet say the request is complete.

  9. Outcome recorded, with its scope and source

    For example a marketing opt-out or erasure confirmed for the scope shown, or partly completed because the organisation keeps some data. Each says its scope and whose word it is: stated by the organisation, reported by you, or independently verified.

  10. Action needed from you

    The organisation needs something only you can do, such as proof of identity, before it can act. The request waits for you, and we say what, why and where.

  11. We’re checking whether your request was sent

    If we can’t tell whether a send went through, we say so and a member of our team checks. We never guess, and we don’t send it again blindly.

Response dates are worked out from the date a request was sent and are provisional. A date passing isn’t a finding that an organisation has done anything wrong, and TraceErase never says an organisation has broken the law.

An example of a managed request, with sample data.

Example viewSample data. Not a real account.

Request to Example Broker Ltd

Received: our team will prepare your request

To: Example Broker Ltd, data protection contact

Asks for: a marketing opt-out, and erasure of data no longer needed. Two separate requests in one email.

I object to the use of my personal data for direct marketing and withdraw any consent to it. Please also erase personal data you no longer need. This request is made for me by TraceErase under my written permission, which I can revoke.

A member of our team checks the exact wording and recipient before anything is sent. Any edit needs approving again. Nothing is sent until then.

What TraceErase doesn’t do

Security and monitoring

  • It isn’t antivirus or device security, and it doesn’t prevent breaches.
  • It doesn’t watch in the background unless you ask it to. Breach checks run when you ask, or on a schedule if you turn that on, and weekly protection, which would repeat the exposure check, is temporarily unavailable.
  • It doesn’t scan broker databases or the wider web. The free exposure check, where it’s available, searches a licensed search index for supported websites and doesn’t open the pages it finds.
  • It doesn’t tell you your data is safe: a result only covers what the breach service has recorded.

Reminder emails depend on the reminder service running and have no promised delivery time, so don’t rely on them alone. Dates are always shown on screen when you sign in.

Requests and outcomes

  • We don’t send a managed request until a member of staff has approved it, and for your own requests TraceErase sends nothing.
  • We don’t log in as you, hold your passwords or get around CAPTCHAs.
  • We don’t cancel loans, close credit accounts, change your credit file or give debt advice.
  • We don’t promise that any organisation will erase any record or that all marketing will stop at once.
  • Nothing here is legal advice.

What a breach check can and can’t tell you

What it can tell you

With the plan, and when the breach service is available, the breach check looks up your account email address in a public breach database. If it is listed, you see which known breaches include it, so you can decide what to change, such as a password.

The password check is separate and comes with your account. The check is done in your browser. The complete password is never sent to TraceErase or to Have I Been Pwned. Only the first five characters of a one-way hash of it are sent to a Have I Been Pwned service.

What it can’t tell you

A result only covers breaches that are publicly known to the service. Not being listed doesn’t prove your data is safe.

If the service is unavailable, TraceErase says the result is unavailable. It never shows “all clear” in its place.

What the exposure check can and can’t tell you

What it can tell you

Where it’s available, the exposure check searches a licensed search index for supported websites and counts the possible references it finds to your name and town. You see how many, across how many websites, review the results and see the steps available for them.

Check my exposure says whether it’s available today. It is free, it is not part of what a plan gives you, and its coverage is very limited at present: the index holds almost none of the person pages of the one website we may search, so finding nothing is the expected result for almost everyone. Detailed exposure reports and weekly protection are temporarily unavailable.

What it can’t tell you

It doesn’t open the pages the results link to, so a result is a possible reference, not confirmed exposure. A search index may not include everything, so a result of none isn’t an all-clear. It isn’t monitoring, and it doesn’t remove anything by itself.

Search the directoryPricing and what the plan includesThe five requests, in plain wordsCompare with doing it yourselfQuestions and answers

Take control of your personal data

Create an account to check a password, search the account clean-up directory and prepare or track privacy requests. Organisations decide their own replies, so TraceErase shows what each one says.

Create your accountSee how it works